CVS Resolution Agreement with HHS Office for Civil Rights for HIPAA Violations

CVS Pharmacy, Inc. recently entered into a “Resolution Agreement” with the DHS Office of Civil Rights for a variety of business practices that were reported in the media concerning disclosure of protected health information (“PHI”).   There was a similar agreement with Providence Health System last year for a $100,000 amount and corrective action plan.

Of note is the size of the settlement – $2.25M.  I also took a look at the Resolution Agreement and the Corrective Action Plan (“CAP”) to note similarities/differences from Corporate Integrity Agreements from OIG.  I saw many similar parallel items from my experience with the CIA front.   Now that the bubble has burst on actual enforcement actions with significant settlement payment amounts, and with the recent HIPAA changes in the Stimulus law, you can bet that there will be both more plaintiff litigation on this front (i.e., HIPAA privacy regulations as the “standard of care” and state tort law as the actual suit mechanism) as well as enforcement action by the Office for Civil Rights.   It is also notable that the “trigger” here was media reports.  Perhaps no accident that the proposed HIPAA changes require media outlet reporting once a threshold of PHI is released.  You can check out the press release and the resolution agreement/CAP at http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/cvsresolutionagreement.html

Filed under: CMP, Health Law, HIPAA, CMP, Health Law, HIPAA, Law